lael-labs/linux

scripts/selinux/mdp/mdp.c+18−5

@@ -67,8 +67,14 @@ int main(int argc, char *argv[]) · 66 unmodified lines
67		67
68	initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);	68	initial_sid_to_string_len = sizeof(initial_sid_to_string) / sizeof (char *);
69	/* print out the sids */	69	/* print out the sids */
70	for (i = 1; i < initial_sid_to_string_len; i++)	70	for (i = 1; i < initial_sid_to_string_len; i++) {
71	fprintf(fout, "sid %s\n", initial_sid_to_string[i]);	71	const char *name = initial_sid_to_string[i];
		72
		73	if (name)
		74	fprintf(fout, "sid %s\n", name);
		75	else
		76	fprintf(fout, "sid unused%d\n", i);
		77	}
72	fprintf(fout, "\n");	78	fprintf(fout, "\n");
73		79
74	/* print out the class permissions */	80	/* print out the class permissions */
@@ -126,9 +132,16 @@ int main(int argc, char *argv[]) · 51 unmodified lines
126	#define OBJUSERROLETYPE "user_u:object_r:base_t"	132	#define OBJUSERROLETYPE "user_u:object_r:base_t"
127		133
128	/* default sids */	134	/* default sids */
129	for (i = 1; i < initial_sid_to_string_len; i++)	135	for (i = 1; i < initial_sid_to_string_len; i++) {
130	fprintf(fout, "sid %s " SUBJUSERROLETYPE "%s\n",	136	const char *name = initial_sid_to_string[i];
131	initial_sid_to_string[i], mls ? ":" SYSTEMLOW : "");	137
		138	if (name)
		139	fprintf(fout, "sid %s ", name);
		140	else
		141	fprintf(fout, "sid unused%d\n", i);
		142	fprintf(fout, SUBJUSERROLETYPE "%s\n",
		143	mls ? ":" SYSTEMLOW : "");
		144	}
132	fprintf(fout, "\n");	145	fprintf(fout, "\n");
133		146
134	#define FS_USE(behavior, fstype) \	147	#define FS_USE(behavior, fstype) \

security/selinux/hooks.c+6−1

 	char *context = NULL;
 	struct inode_security_struct *isec;
-	if (strcmp(name, XATTR_SELINUX_SUFFIX))
+	/*
+	 * If we're not initialized yet, then we can't validate contexts, so
+	 * just let vfs_getxattr fall back to using the on-disk xattr.
+	 */
+	if (!selinux_initialized(&selinux_state) ||
+	    strcmp(name, XATTR_SELINUX_SUFFIX))
 		return -EOPNOTSUPP;
 	/*

security/selinux/netif.c+1−1

@@ -124,7 +124,7 @@ static void sel_netif_destroy(struct sel_netif *netif) · 123 unmodified lines
124	* @sid: interface SID	124	* @sid: interface SID
125	*	125	*
126	* Description:	126	* Description:
127	* This function determines the SID of a network interface by quering the	127	* This function determines the SID of a network interface by querying the
128	* security policy. The result is added to the network interface table to	128	* security policy. The result is added to the network interface table to
129	* speedup future queries. Returns zero on success, negative values on	129	* speedup future queries. Returns zero on success, negative values on
130	* failure.	130	* failure.

security/selinux/netnode.c+1−1

@@ -181,7 +181,7 @@ static void sel_netnode_insert(struct sel_netnode *node) · 180 unmodified lines
181	* @sid: node SID	181	* @sid: node SID
182	*	182	*
183	* Description:	183	* Description:
184	* This function determines the SID of a network address by quering the	184	* This function determines the SID of a network address by querying the
185	* security policy. The result is added to the network address table to	185	* security policy. The result is added to the network address table to
186	* speedup future queries. Returns zero on success, negative values on	186	* speedup future queries. Returns zero on success, negative values on
187	* failure.	187	* failure.

security/selinux/netport.c+1−1

@@ -130,7 +130,7 @@ static void sel_netport_insert(struct sel_netport *port) · 129 unmodified lines
130	* @sid: port SID	130	* @sid: port SID
131	*	131	*
132	* Description:	132	* Description:
133	* This function determines the SID of a network port by quering the security	133	* This function determines the SID of a network port by querying the security
134	* policy. The result is added to the network port table to speedup future	134	* policy. The result is added to the network port table to speedup future
135	* queries. Returns zero on success, negative values on failure.	135	* queries. Returns zero on success, negative values on failure.
136	*	136	*

security/selinux/ss/conditional.c+4−4

@@ -203,7 +203,7 @@ static int bool_isvalid(struct cond_bool_datum *b) · 202 unmodified lines
203	return 1;	203	return 1;
204	}	204	}
205		205
206	int cond_read_bool(struct policydb p, struct hashtab h, void *fp)	206	int cond_read_bool(struct policydb p, struct symtab s, void *fp)
207	{	207	{
208	char *key = NULL;	208	char *key = NULL;
209	struct cond_bool_datum *booldatum;	209	struct cond_bool_datum *booldatum;
@@ -215,7 +215,7 @@ int cond_read_bool(struct policydb p, struct hashtab h, void *fp) · 5 unmodified lines
215	if (!booldatum)	215	if (!booldatum)
216	return -ENOMEM;	216	return -ENOMEM;
217		217
218	rc = next_entry(buf, fp, sizeof buf);	218	rc = next_entry(buf, fp, sizeof(buf));
219	if (rc)	219	if (rc)
220	goto err;	220	goto err;
221		221
@@ -238,7 +238,7 @@ int cond_read_bool(struct policydb p, struct hashtab h, void *fp) · 16 unmodified lines
238	if (rc)	238	if (rc)
239	goto err;	239	goto err;
240	key[len] = '\0';	240	key[len] = '\0';
241	rc = hashtab_insert(h, key, booldatum);	241	rc = symtab_insert(s, key, booldatum);
242	if (rc)	242	if (rc)
243	goto err;	243	goto err;
244		244
@@ -416,7 +416,7 @@ int cond_read_list(struct policydb p, void fp) · 171 unmodified lines
416	u32 i, len;	416	u32 i, len;
417	int rc;	417	int rc;
418		418
419	rc = next_entry(buf, fp, sizeof buf);	419	rc = next_entry(buf, fp, sizeof(buf));
420	if (rc)	420	if (rc)
421	return rc;	421	return rc;
422		422

security/selinux/ss/conditional.h+1−1

@@ -69,7 +69,7 @@ int cond_destroy_bool(void key, void datum, void *p); · 68 unmodified lines
69		69
70	int cond_index_bool(void key, void datum, void *datap);	70	int cond_index_bool(void key, void datum, void *datap);
71		71
72	int cond_read_bool(struct policydb p, struct hashtab h, void *fp);	72	int cond_read_bool(struct policydb p, struct symtab s, void *fp);
73	int cond_read_list(struct policydb p, void fp);	73	int cond_read_list(struct policydb p, void fp);
74	int cond_write_bool(void key, void datum, void *ptr);	74	int cond_write_bool(void key, void datum, void *ptr);
75	int cond_write_list(struct policydb p, void fp);	75	int cond_write_list(struct policydb p, void fp);

security/selinux/ss/hashtab.c+6−53

@@ -7,7 +7,6 @@ · 6 unmodified lines
7	#include <linux/kernel.h>	7	#include <linux/kernel.h>
8	#include <linux/slab.h>	8	#include <linux/slab.h>
9	#include <linux/errno.h>	9	#include <linux/errno.h>
10	#include <linux/sched.h>
11	#include "hashtab.h"	10	#include "hashtab.h"
12		11
13	static struct kmem_cache *hashtab_node_cachep;	12	static struct kmem_cache *hashtab_node_cachep;
@@ -29,16 +28,10 @@ static u32 hashtab_compute_size(u32 nel) · 15 unmodified lines
29	return nel == 0 ? 0 : roundup_pow_of_two(nel);	28	return nel == 0 ? 0 : roundup_pow_of_two(nel);
30	}	29	}
31		30
32	int hashtab_init(struct hashtab *h,	31	int hashtab_init(struct hashtab *h, u32 nel_hint)
33	u32 (hash_value)(struct hashtab h, const void *key),
34	int (keycmp)(struct hashtab h, const void *key1,
35	const void *key2),
36	u32 nel_hint)
37	{	32	{
38	h->size = hashtab_compute_size(nel_hint);	33	h->size = hashtab_compute_size(nel_hint);
39	h->nel = 0;	34	h->nel = 0;
40	h->hash_value = hash_value;
41	h->keycmp = keycmp;
42	if (!h->size)	35	if (!h->size)
43	return 0;	36	return 0;
44		37
@@ -46,63 +39,23 @@ int hashtab_init(struct hashtab *h, · 1 unmodified line
46	return h->htable ? 0 : -ENOMEM;	39	return h->htable ? 0 : -ENOMEM;
47	}	40	}
48		41
49	int hashtab_insert(struct hashtab h, void key, void *datum)	42	int __hashtab_insert(struct hashtab h, struct hashtab_node *dst,
		43	void key, void datum)
50	{	44	{
51	u32 hvalue;	45	struct hashtab_node *newnode;
52	struct hashtab_node prev, cur, *newnode;
53
54	cond_resched();
55
56	if (!h->size \|\| h->nel == HASHTAB_MAX_NODES)
57	return -EINVAL;
58
59	hvalue = h->hash_value(h, key);
60	prev = NULL;
61	cur = h->htable[hvalue];
62	while (cur && h->keycmp(h, key, cur->key) > 0) {
63	prev = cur;
64	cur = cur->next;
65	}
66
67	if (cur && (h->keycmp(h, key, cur->key) == 0))
68	return -EEXIST;
69		46
70	newnode = kmem_cache_zalloc(hashtab_node_cachep, GFP_KERNEL);	47	newnode = kmem_cache_zalloc(hashtab_node_cachep, GFP_KERNEL);
71	if (!newnode)	48	if (!newnode)
72	return -ENOMEM;	49	return -ENOMEM;
73	newnode->key = key;	50	newnode->key = key;
74	newnode->datum = datum;	51	newnode->datum = datum;
75	if (prev) {	52	newnode->next = *dst;
76	newnode->next = prev->next;	53	*dst = newnode;
77	prev->next = newnode;
78	} else {
79	newnode->next = h->htable[hvalue];
80	h->htable[hvalue] = newnode;
81	}
82		54
83	h->nel++;	55	h->nel++;
84	return 0;	56	return 0;
85	}	57	}
86		58
87	void hashtab_search(struct hashtab h, const void *key)
88	{
89	u32 hvalue;
90	struct hashtab_node *cur;
91
92	if (!h->size)
93	return NULL;
94
95	hvalue = h->hash_value(h, key);
96	cur = h->htable[hvalue];
97	while (cur && h->keycmp(h, key, cur->key) > 0)
98	cur = cur->next;
99
100	if (!cur \|\| (h->keycmp(h, key, cur->key) != 0))
101	return NULL;
102
103	return cur->datum;
104	}
105
106	void hashtab_destroy(struct hashtab *h)	59	void hashtab_destroy(struct hashtab *h)
107	{	60	{
108	u32 i;	61	u32 i;

security/selinux/ss/hashtab.h+65−12

@@ -11,7 +11,17 @@ · 10 unmodified lines
11	#ifndef _SS_HASHTAB_H_	11	#ifndef _SS_HASHTAB_H_
12	#define _SS_HASHTAB_H_	12	#define _SS_HASHTAB_H_
13		13
14	#define HASHTAB_MAX_NODES 0xffffffff	14	#include <linux/types.h>
		15	#include <linux/errno.h>
		16	#include <linux/sched.h>
		17
		18	#define HASHTAB_MAX_NODES U32_MAX
		19
		20	struct hashtab_key_params {
		21	u32 (hash)(const void key); /* hash function */
		22	int (cmp)(const void key1, const void *key2);
		23	/* key comparison function */
		24	};
15		25
16	struct hashtab_node {	26	struct hashtab_node {
17	void *key;	27	void *key;
@@ -23,10 +33,6 @@ struct hashtab { · 5 unmodified lines
23	struct hashtab_node *htable; / hash table */	33	struct hashtab_node *htable; / hash table */
24	u32 size; /* number of slots in hash table */	34	u32 size; /* number of slots in hash table */
25	u32 nel; /* number of elements in hash table */	35	u32 nel; /* number of elements in hash table */
26	u32 (hash_value)(struct hashtab h, const void *key);
27	/* hash function */
28	int (keycmp)(struct hashtab h, const void key1, const void key2);
29	/* key comparison function */
30	};	36	};
31		37
32	struct hashtab_info {	38	struct hashtab_info {
@@ -39,11 +45,10 @@ struct hashtab_info { · 6 unmodified lines
39	*	45	*
40	* Returns -ENOMEM if insufficient space is available or 0 otherwise.	46	* Returns -ENOMEM if insufficient space is available or 0 otherwise.
41	*/	47	*/
42	int hashtab_init(struct hashtab *h,	48	int hashtab_init(struct hashtab *h, u32 nel_hint);
43	u32 (hash_value)(struct hashtab h, const void *key),	49
44	int (keycmp)(struct hashtab h, const void *key1,	50	int __hashtab_insert(struct hashtab h, struct hashtab_node *dst,
45	const void *key2),	51	void key, void datum);
46	u32 nel_hint);
47		52
48	/*	53	/*
49	* Inserts the specified (key, datum) pair into the specified hash table.	54	* Inserts the specified (key, datum) pair into the specified hash table.
@@ -53,7 +58,34 @@ int hashtab_init(struct hashtab *h, · 3 unmodified lines
53	* -EINVAL for general errors or	58	* -EINVAL for general errors or
54	0 otherwise.	59	0 otherwise.
55	*/	60	*/
56	int hashtab_insert(struct hashtab h, void k, void *d);	61	static inline int hashtab_insert(struct hashtab h, void key, void *datum,
		62	struct hashtab_key_params key_params)
		63	{
		64	u32 hvalue;
		65	struct hashtab_node prev, cur;
		66
		67	cond_resched();
		68
		69	if (!h->size \|\| h->nel == HASHTAB_MAX_NODES)
		70	return -EINVAL;
		71
		72	hvalue = key_params.hash(key) & (h->size - 1);
		73	prev = NULL;
		74	cur = h->htable[hvalue];
		75	while (cur) {
		76	int cmp = key_params.cmp(key, cur->key);
		77
		78	if (cmp == 0)
		79	return -EEXIST;
		80	if (cmp < 0)
		81	break;
		82	prev = cur;
		83	cur = cur->next;
		84	}
		85
		86	return __hashtab_insert(h, prev ? &prev->next : &h->htable[hvalue],
		87	key, datum);
		88	}
57		89
58	/*	90	/*
59	* Searches for the entry with the specified key in the hash table.	91	* Searches for the entry with the specified key in the hash table.
@@ -61,7 +93,28 @@ int hashtab_insert(struct hashtab h, void k, void *d); · 1 unmodified line
61	* Returns NULL if no entry has the specified key or	93	* Returns NULL if no entry has the specified key or
62	* the datum of the entry otherwise.	94	* the datum of the entry otherwise.
63	*/	95	*/
64	void hashtab_search(struct hashtab h, const void *k);	96	static inline void hashtab_search(struct hashtab h, const void *key,
		97	struct hashtab_key_params key_params)
		98	{
		99	u32 hvalue;
		100	struct hashtab_node *cur;
		101
		102	if (!h->size)
		103	return NULL;
		104
		105	hvalue = key_params.hash(key) & (h->size - 1);
		106	cur = h->htable[hvalue];
		107	while (cur) {
		108	int cmp = key_params.cmp(key, cur->key);
		109
		110	if (cmp == 0)
		111	return cur->datum;
		112	if (cmp < 0)
		113	break;
		114	cur = cur->next;
		115	}
		116	return NULL;
		117	}
65		118
66	/*	119	/*
67	* Destroys the specified hash table.	120	* Destroys the specified hash table.

security/selinux/ss/mls.c+12−11

@@ -165,8 +165,8 @@ int mls_level_isvalid(struct policydb p, struct mls_level l) · 164 unmodified lines
165		165
166	if (!l->sens \|\| l->sens > p->p_levels.nprim)	166	if (!l->sens \|\| l->sens > p->p_levels.nprim)
167	return 0;	167	return 0;
168	levdatum = hashtab_search(&p->p_levels.table,	168	levdatum = symtab_search(&p->p_levels,
169	sym_name(p, SYM_LEVELS, l->sens - 1));	169	sym_name(p, SYM_LEVELS, l->sens - 1));
170	if (!levdatum)	170	if (!levdatum)
171	return 0;	171	return 0;
172		172
@@ -293,7 +293,7 @@ int mls_context_to_sid(struct policydb *pol, · 120 unmodified lines
293	*(next_cat++) = '\0';	293	*(next_cat++) = '\0';
294		294
295	/* Parse sensitivity. */	295	/* Parse sensitivity. */
296	levdatum = hashtab_search(&pol->p_levels.table, sensitivity);	296	levdatum = symtab_search(&pol->p_levels, sensitivity);
297	if (!levdatum)	297	if (!levdatum)
298	return -EINVAL;	298	return -EINVAL;
299	context->range.level[l].sens = levdatum->level->sens;	299	context->range.level[l].sens = levdatum->level->sens;
@@ -312,7 +312,7 @@ int mls_context_to_sid(struct policydb *pol, · 12 unmodified lines
312	*rngptr++ = '\0';	312	*rngptr++ = '\0';
313	}	313	}
314		314
315	catdatum = hashtab_search(&pol->p_cats.table, cur_cat);	315	catdatum = symtab_search(&pol->p_cats, cur_cat);
316	if (!catdatum)	316	if (!catdatum)
317	return -EINVAL;	317	return -EINVAL;
318		318
@@ -325,7 +325,7 @@ int mls_context_to_sid(struct policydb *pol, · 6 unmodified lines
325	if (rngptr == NULL)	325	if (rngptr == NULL)
326	continue;	326	continue;
327		327
328	rngdatum = hashtab_search(&pol->p_cats.table, rngptr);	328	rngdatum = symtab_search(&pol->p_cats, rngptr);
329	if (!rngdatum)	329	if (!rngdatum)
330	return -EINVAL;	330	return -EINVAL;
331		331
@@ -458,9 +458,10 @@ int mls_convert_context(struct policydb *oldp, · 126 unmodified lines
458	return 0;	458	return 0;
459		459
460	for (l = 0; l < 2; l++) {	460	for (l = 0; l < 2; l++) {
461	levdatum = hashtab_search(&newp->p_levels.table,	461	char *name = sym_name(oldp, SYM_LEVELS,
462	sym_name(oldp, SYM_LEVELS,	462	oldc->range.level[l].sens - 1);
463	oldc->range.level[l].sens - 1));	463
		464	levdatum = symtab_search(&newp->p_levels, name);
464		465
465	if (!levdatum)	466	if (!levdatum)
466	return -EINVAL;	467	return -EINVAL;
@@ -470,8 +471,8 @@ int mls_convert_context(struct policydb *oldp, · 3 unmodified lines
470	node, i) {	471	node, i) {
471	int rc;	472	int rc;
472		473
473	catdatum = hashtab_search(&newp->p_cats.table,	474	catdatum = symtab_search(&newp->p_cats,
474	sym_name(oldp, SYM_CATS, i));	475	sym_name(oldp, SYM_CATS, i));
475	if (!catdatum)	476	if (!catdatum)
476	return -EINVAL;	477	return -EINVAL;
477	rc = ebitmap_set_bit(&newc->range.level[l].cat,	478	rc = ebitmap_set_bit(&newc->range.level[l].cat,
@@ -506,7 +507,7 @@ int mls_compute_sid(struct policydb *p, · 28 unmodified lines
506	rtr.source_type = scontext->type;	507	rtr.source_type = scontext->type;
507	rtr.target_type = tcontext->type;	508	rtr.target_type = tcontext->type;
508	rtr.target_class = tclass;	509	rtr.target_class = tclass;
509	r = hashtab_search(&p->range_tr, &rtr);	510	r = policydb_rangetr_search(p, &rtr);
510	if (r)	511	if (r)
511	return mls_range_set(newcontext, r);	512	return mls_range_set(newcontext, r);
512		513

security/selinux/ss/policydb.c+95−53

 	if (!key)
 		goto out;
-	rc = hashtab_insert(&p->p_roles.table, key, role);
+	rc = symtab_insert(&p->p_roles, key, role);
 	if (rc)
 		goto out;
 	return rc;
 }
-static u32 filenametr_hash(struct hashtab *h, const void *k)
+static u32 filenametr_hash(const void *k)
 {
 	const struct filename_trans_key *ft = k;
 	unsigned long hash;
 	byte_num = 0;
 	while ((focus = ft->name[byte_num++]))
 		hash = partial_name_hash(focus, hash);
-	return hash & (h->size - 1);
+	return hash;
 }
-static int filenametr_cmp(struct hashtab *h, const void *k1, const void *k2)
+static int filenametr_cmp(const void *k1, const void *k2)
 {
 	const struct filename_trans_key *ft1 = k1;
 	const struct filename_trans_key *ft2 = k2;
 }
-static u32 rangetr_hash(struct hashtab *h, const void *k)
+static const struct hashtab_key_params filenametr_key_params = {
+	.hash = filenametr_hash,
+	.cmp = filenametr_cmp,
+};
+struct filename_trans_datum *policydb_filenametr_search(
+	struct policydb *p, struct filename_trans_key *key)
+{
+	return hashtab_search(&p->filename_trans, key, filenametr_key_params);
+}
+static u32 rangetr_hash(const void *k)
 {
 	const struct range_trans *key = k;
-	return (key->source_type + (key->target_type << 3) +
+	return key->source_type + (key->target_type << 3) +
-		(key->target_class << 5)) & (h->size - 1);
+		(key->target_class << 5);
 }
-static int rangetr_cmp(struct hashtab *h, const void *k1, const void *k2)
+static int rangetr_cmp(const void *k1, const void *k2)
 {
 	const struct range_trans *key1 = k1, *key2 = k2;
 	int v;
 	return v;
 }
-static u32 role_trans_hash(struct hashtab *h, const void *k)
+static const struct hashtab_key_params rangetr_key_params = {
+	.hash = rangetr_hash,
+	.cmp = rangetr_cmp,
+};
+struct mls_range *policydb_rangetr_search(struct policydb *p,
+					  struct range_trans *key)
+{
+	return hashtab_search(&p->range_tr, key, rangetr_key_params);
+}
+static u32 role_trans_hash(const void *k)
 {
 	const struct role_trans_key *key = k;
-	return (key->role + (key->type << 3) + (key->tclass << 5)) &
+	return key->role + (key->type << 3) + (key->tclass << 5);
-		(h->size - 1);
 }
-static int role_trans_cmp(struct hashtab *h, const void *k1, const void *k2)
+static int role_trans_cmp(const void *k1, const void *k2)
 {
 	const struct role_trans_key *key1 = k1, *key2 = k2;
 	int v;
 	return key1->tclass - key2->tclass;
 }
+static const struct hashtab_key_params roletr_key_params = {
+	.hash = role_trans_hash,
+	.cmp = role_trans_cmp,
+};
+struct role_trans_datum *policydb_roletr_search(struct policydb *p,
+						struct role_trans_key *key)
+{
+	return hashtab_search(&p->role_tr, key, roletr_key_params);
+}
 /*
  * Initialize a policy database structure.
  */
 	return 0;
 }
-static int perm_read(struct policydb *p, struct hashtab *h, void *fp)
+static int perm_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct perm_datum *perdatum;
 	if (rc)
 		goto bad;
-	rc = hashtab_insert(h, key, perdatum);
+	rc = symtab_insert(s, key, perdatum);
 	if (rc)
 		goto bad;
 	return rc;
 }
-static int common_read(struct policydb *p, struct hashtab *h, void *fp)
+static int common_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct common_datum *comdatum;
 		goto bad;
 	for (i = 0; i < nel; i++) {
-		rc = perm_read(p, &comdatum->permissions.table, fp);
+		rc = perm_read(p, &comdatum->permissions, fp);
 		if (rc)
 			goto bad;
 	}
-	rc = hashtab_insert(h, key, comdatum);
+	rc = symtab_insert(s, key, comdatum);
 	if (rc)
 		goto bad;
 	return 0;
 	return 0;
 }
-static int class_read(struct policydb *p, struct hashtab *h, void *fp)
+static int class_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct class_datum *cladatum;
 			goto bad;
 		rc = -EINVAL;
-		cladatum->comdatum = hashtab_search(&p->p_commons.table,
+		cladatum->comdatum = symtab_search(&p->p_commons,
-						    cladatum->comkey);
+						   cladatum->comkey);
 		if (!cladatum->comdatum) {
 			pr_err("SELinux:  unknown common %s\n",
 			       cladatum->comkey);
 		}
 	}
 	for (i = 0; i < nel; i++) {
-		rc = perm_read(p, &cladatum->permissions.table, fp);
+		rc = perm_read(p, &cladatum->permissions, fp);
 		if (rc)
 			goto bad;
 	}
 		cladatum->default_type = le32_to_cpu(buf[0]);
 	}
-	rc = hashtab_insert(h, key, cladatum);
+	rc = symtab_insert(s, key, cladatum);
 	if (rc)
 		goto bad;
 	return rc;
 }
-static int role_read(struct policydb *p, struct hashtab *h, void *fp)
+static int role_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct role_datum *role;
 		goto bad;
 	}
-	rc = hashtab_insert(h, key, role);
+	rc = symtab_insert(s, key, role);
 	if (rc)
 		goto bad;
 	return 0;
 	return rc;
 }
-static int type_read(struct policydb *p, struct hashtab *h, void *fp)
+static int type_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct type_datum *typdatum;
 	if (rc)
 		goto bad;
-	rc = hashtab_insert(h, key, typdatum);
+	rc = symtab_insert(s, key, typdatum);
 	if (rc)
 		goto bad;
 	return 0;
 	return 0;
 }
-static int user_read(struct policydb *p, struct hashtab *h, void *fp)
+static int user_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct user_datum *usrdatum;
 			goto bad;
 	}
-	rc = hashtab_insert(h, key, usrdatum);
+	rc = symtab_insert(s, key, usrdatum);
 	if (rc)
 		goto bad;
 	return 0;
 	return rc;
 }
-static int sens_read(struct policydb *p, struct hashtab *h, void *fp)
+static int sens_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct level_datum *levdatum;
 	if (rc)
 		goto bad;
-	rc = hashtab_insert(h, key, levdatum);
+	rc = symtab_insert(s, key, levdatum);
 	if (rc)
 		goto bad;
 	return 0;
 	return rc;
 }
-static int cat_read(struct policydb *p, struct hashtab *h, void *fp)
+static int cat_read(struct policydb *p, struct symtab *s, void *fp)
 {
 	char *key = NULL;
 	struct cat_datum *catdatum;
 	if (rc)
 		goto bad;
-	rc = hashtab_insert(h, key, catdatum);
+	rc = symtab_insert(s, key, catdatum);
 	if (rc)
 		goto bad;
 	return 0;
 	return rc;
 }
-static int (*read_f[SYM_NUM]) (struct policydb *p, struct hashtab *h, void *fp) =
+static int (*read_f[SYM_NUM]) (struct policydb *p, struct symtab *s, void *fp) =
 {
 	common_read,
 	class_read,
 {
 	struct class_datum *cladatum;
-	cladatum = hashtab_search(&p->p_classes.table, name);
+	cladatum = symtab_search(&p->p_classes, name);
 	if (!cladatum)
 		return 0;
 	cladatum = p->class_val_to_struct[tclass-1];
 	comdatum = cladatum->comdatum;
 	if (comdatum)
-		perdatum = hashtab_search(&comdatum->permissions.table, name);
+		perdatum = symtab_search(&comdatum->permissions, name);
 	if (!perdatum)
-		perdatum = hashtab_search(&cladatum->permissions.table, name);
+		perdatum = symtab_search(&cladatum->permissions, name);
 	if (!perdatum)
 		return 0;
 	nel = le32_to_cpu(buf[0]);
-	rc = hashtab_init(&p->range_tr, rangetr_hash, rangetr_cmp, nel);
+	rc = hashtab_init(&p->range_tr, nel);
 	if (rc)
 		return rc;
 			goto out;
 		}
-		rc = hashtab_insert(&p->range_tr, rt, r);
+		rc = hashtab_insert(&p->range_tr, rt, r, rangetr_key_params);
 		if (rc)
 			goto out;
 	otype = le32_to_cpu(buf[3]);
 	last = NULL;
-	datum = hashtab_search(&p->filename_trans, &key);
+	datum = policydb_filenametr_search(p, &key);
 	while (datum) {
 		if (unlikely(ebitmap_get_bit(&datum->stypes, stype - 1))) {
 			/* conflicting/duplicate rules are ignored */
 			if (!ft)
 				goto out;
-			rc = hashtab_insert(&p->filename_trans, ft, datum);
+			rc = hashtab_insert(&p->filename_trans, ft, datum,
+					    filenametr_key_params);
 			if (rc)
 				goto out;
 			name = NULL;
 	ft->tclass = tclass;
 	ft->name = name;
-	rc = hashtab_insert(&p->filename_trans, ft, first);
+	rc = hashtab_insert(&p->filename_trans, ft, first,
+			    filenametr_key_params);
 	if (rc == -EEXIST)
 		pr_err("SELinux:  Duplicate filename transition key\n");
 	if (rc)
 	if (p->policyvers < POLICYDB_VERSION_COMP_FTRANS) {
 		p->compat_filename_trans_count = nel;
-		rc = hashtab_init(&p->filename_trans, filenametr_hash,
+		rc = hashtab_init(&p->filename_trans, (1 << 11));
-				  filenametr_cmp, (1 << 11));
 		if (rc)
 			return rc;
 				return rc;
 		}
 	} else {
-		rc = hashtab_init(&p->filename_trans, filenametr_hash,
+		rc = hashtab_init(&p->filename_trans, nel);
-				  filenametr_cmp, nel);
 		if (rc)
 			return rc;
 	struct role_trans_datum *rtd = NULL;
 	int i, j, rc;
 	__le32 buf[4];
-	u32 len, nprim, nel;
+	u32 len, nprim, nel, perm;
 	char *policydb_str;
 	struct policydb_compat_info *info;
 		}
 		for (j = 0; j < nel; j++) {
-			rc = read_f[i](p, &p->symtab[i].table, fp);
+			rc = read_f[i](p, &p->symtab[i], fp);
 			if (rc)
 				goto bad;
 		}
 	rc = -EINVAL;
 	p->process_class = string_to_security_class(p, "process");
-	if (!p->process_class)
+	if (!p->process_class) {
+		pr_err("SELinux: process class is required, not defined in policy\n");
 		goto bad;
+	}
 	rc = avtab_read(&p->te_avtab, fp, p);
 	if (rc)
 		goto bad;
 	nel = le32_to_cpu(buf[0]);
-	rc = hashtab_init(&p->role_tr, role_trans_hash, role_trans_cmp, nel);
+	rc = hashtab_init(&p->role_tr, nel);
 	if (rc)
 		goto bad;
 	for (i = 0; i < nel; i++) {
 		    !policydb_role_isvalid(p, rtd->new_role))
 			goto bad;
-		rc = hashtab_insert(&p->role_tr, rtk, rtd);
+		rc = hashtab_insert(&p->role_tr, rtk, rtd, roletr_key_params);
 		if (rc)
 			goto bad;
 		goto bad;
 	rc = -EINVAL;
-	p->process_trans_perms = string_to_av_perm(p, p->process_class, "transition");
+	perm = string_to_av_perm(p, p->process_class, "transition");
-	p->process_trans_perms |= string_to_av_perm(p, p->process_class, "dyntransition");
+	if (!perm) {
-	if (!p->process_trans_perms)
+		pr_err("SELinux: process transition permission is required, not defined in policy\n");
+		goto bad;
+	}
+	p->process_trans_perms = perm;
+	perm = string_to_av_perm(p, p->process_class, "dyntransition");
+	if (!perm) {
+		pr_err("SELinux: process dyntransition permission is required, not defined in policy\n");
 		goto bad;
+	}
+	p->process_trans_perms |= perm;
 	rc = ocontext_read(p, info, fp);
 	if (rc)

security/selinux/ss/policydb.h+9−0

@@ -324,6 +324,15 @@ extern int policydb_role_isvalid(struct policydb *p, unsigned int role); · 323 unmodified lines
324	extern int policydb_read(struct policydb p, void fp);	324	extern int policydb_read(struct policydb p, void fp);
325	extern int policydb_write(struct policydb p, void fp);	325	extern int policydb_write(struct policydb p, void fp);
326		326
		327	extern struct filename_trans_datum *policydb_filenametr_search(
		328	struct policydb p, struct filename_trans_key key);
		329
		330	extern struct mls_range *policydb_rangetr_search(
		331	struct policydb p, struct range_trans key);
		332
		333	extern struct role_trans_datum *policydb_roletr_search(
		334	struct policydb p, struct role_trans_key key);
		335
327	#define POLICYDB_CONFIG_MLS 1	336	#define POLICYDB_CONFIG_MLS 1
328		337
329	/* the config flags related to unknown classes/perms are bits 2 and 3 */	338	/* the config flags related to unknown classes/perms are bits 2 and 3 */

security/selinux/ss/services.c+19−19

@@ -1441,7 +1441,7 @@ static int string_to_context_struct(struct policydb *pol, · 1440 unmodified lines
1441		1441
1442	*p++ = 0;	1442	*p++ = 0;
1443		1443
1444	usrdatum = hashtab_search(&pol->p_users.table, scontextp);	1444	usrdatum = symtab_search(&pol->p_users, scontextp);
1445	if (!usrdatum)	1445	if (!usrdatum)
1446	goto out;	1446	goto out;
1447		1447
@@ -1457,7 +1457,7 @@ static int string_to_context_struct(struct policydb *pol, · 9 unmodified lines
1457		1457
1458	*p++ = 0;	1458	*p++ = 0;
1459		1459
1460	role = hashtab_search(&pol->p_roles.table, scontextp);	1460	role = symtab_search(&pol->p_roles, scontextp);
1461	if (!role)	1461	if (!role)
1462	goto out;	1462	goto out;
1463	ctx->role = role->value;	1463	ctx->role = role->value;
@@ -1469,7 +1469,7 @@ static int string_to_context_struct(struct policydb *pol, · 5 unmodified lines
1469	oldc = *p;	1469	oldc = *p;
1470	*p++ = 0;	1470	*p++ = 0;
1471		1471
1472	typdatum = hashtab_search(&pol->p_types.table, scontextp);	1472	typdatum = symtab_search(&pol->p_types, scontextp);
1473	if (!typdatum \|\| typdatum->attribute)	1473	if (!typdatum \|\| typdatum->attribute)
1474	goto out;	1474	goto out;
1475		1475
@@ -1671,7 +1671,7 @@ static void filename_compute_type(struct policydb *policydb, · 195 unmodified lines
1671	ft.tclass = tclass;	1671	ft.tclass = tclass;
1672	ft.name = objname;	1672	ft.name = objname;
1673		1673
1674	datum = hashtab_search(&policydb->filename_trans, &ft);	1674	datum = policydb_filenametr_search(policydb, &ft);
1675	while (datum) {	1675	while (datum) {
1676	if (ebitmap_get_bit(&datum->stypes, stype - 1)) {	1676	if (ebitmap_get_bit(&datum->stypes, stype - 1)) {
1677	newcontext->type = datum->otype;	1677	newcontext->type = datum->otype;
@@ -1834,7 +1834,7 @@ static int security_compute_sid(struct selinux_state *state, · 156 unmodified lines
1834	.tclass = tclass,	1834	.tclass = tclass,
1835	};	1835	};
1836		1836
1837	rtd = hashtab_search(&policydb->role_tr, &rtk);	1837	rtd = policydb_roletr_search(policydb, &rtk);
1838	if (rtd)	1838	if (rtd)
1839	newcontext.role = rtd->new_role;	1839	newcontext.role = rtd->new_role;
1840	}	1840	}
@@ -2024,26 +2024,26 @@ static int convert_context(struct context oldc, struct context newc, void *p) · 183 unmodified lines
2024		2024
2025	/* Convert the user. */	2025	/* Convert the user. */
2026	rc = -EINVAL;	2026	rc = -EINVAL;
2027	usrdatum = hashtab_search(&args->newp->p_users.table,	2027	usrdatum = symtab_search(&args->newp->p_users,
2028	sym_name(args->oldp,	2028	sym_name(args->oldp,
2029	SYM_USERS, oldc->user - 1));	2029	SYM_USERS, oldc->user - 1));
2030	if (!usrdatum)	2030	if (!usrdatum)
2031	goto bad;	2031	goto bad;
2032	newc->user = usrdatum->value;	2032	newc->user = usrdatum->value;
2033		2033
2034	/* Convert the role. */	2034	/* Convert the role. */
2035	rc = -EINVAL;	2035	rc = -EINVAL;
2036	role = hashtab_search(&args->newp->p_roles.table,	2036	role = symtab_search(&args->newp->p_roles,
2037	sym_name(args->oldp, SYM_ROLES, oldc->role - 1));	2037	sym_name(args->oldp, SYM_ROLES, oldc->role - 1));
2038	if (!role)	2038	if (!role)
2039	goto bad;	2039	goto bad;
2040	newc->role = role->value;	2040	newc->role = role->value;
2041		2041
2042	/* Convert the type. */	2042	/* Convert the type. */
2043	rc = -EINVAL;	2043	rc = -EINVAL;
2044	typdatum = hashtab_search(&args->newp->p_types.table,	2044	typdatum = symtab_search(&args->newp->p_types,
2045	sym_name(args->oldp,	2045	sym_name(args->oldp,
2046	SYM_TYPES, oldc->type - 1));	2046	SYM_TYPES, oldc->type - 1));
2047	if (!typdatum)	2047	if (!typdatum)
2048	goto bad;	2048	goto bad;
2049	newc->type = typdatum->value;	2049	newc->type = typdatum->value;
@@ -2623,7 +2623,7 @@ int security_get_user_sids(struct selinux_state *state, · 573 unmodified lines
2623	goto out_unlock;	2623	goto out_unlock;
2624		2624
2625	rc = -EINVAL;	2625	rc = -EINVAL;
2626	user = hashtab_search(&policydb->p_users.table, username);	2626	user = symtab_search(&policydb->p_users, username);
2627	if (!user)	2627	if (!user)
2628	goto out_unlock;	2628	goto out_unlock;
2629		2629
@@ -2979,7 +2979,7 @@ static int security_preserve_bools(struct selinux_state *state, · 349 unmodified lines
2979	if (rc)	2979	if (rc)
2980	goto out;	2980	goto out;
2981	for (i = 0; i < nbools; i++) {	2981	for (i = 0; i < nbools; i++) {
2982	booldatum = hashtab_search(&policydb->p_bools.table, bnames[i]);	2982	booldatum = symtab_search(&policydb->p_bools, bnames[i]);
2983	if (booldatum)	2983	if (booldatum)
2984	booldatum->state = bvalues[i];	2984	booldatum->state = bvalues[i];
2985	}	2985	}
@@ -3230,7 +3230,7 @@ int security_get_permissions(struct selinux_state *state, · 244 unmodified lines
3230	read_lock(&state->ss->policy_rwlock);	3230	read_lock(&state->ss->policy_rwlock);
3231		3231
3232	rc = -EINVAL;	3232	rc = -EINVAL;
3233	match = hashtab_search(&policydb->p_classes.table, class);	3233	match = symtab_search(&policydb->p_classes, class);
3234	if (!match) {	3234	if (!match) {
3235	pr_err("SELinux: %s: unrecognized class %s\n",	3235	pr_err("SELinux: %s: unrecognized class %s\n",
3236	__func__, class);	3236	__func__, class);
@@ -3369,7 +3369,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char rulestr, void *vrule) · 132 unmodified lines
3369	case AUDIT_SUBJ_USER:	3369	case AUDIT_SUBJ_USER:
3370	case AUDIT_OBJ_USER:	3370	case AUDIT_OBJ_USER:
3371	rc = -EINVAL;	3371	rc = -EINVAL;
3372	userdatum = hashtab_search(&policydb->p_users.table, rulestr);	3372	userdatum = symtab_search(&policydb->p_users, rulestr);
3373	if (!userdatum)	3373	if (!userdatum)
3374	goto out;	3374	goto out;
3375	tmprule->au_ctxt.user = userdatum->value;	3375	tmprule->au_ctxt.user = userdatum->value;
@@ -3377,7 +3377,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char rulestr, void *vrule) · 1 unmodified line
3377	case AUDIT_SUBJ_ROLE:	3377	case AUDIT_SUBJ_ROLE:
3378	case AUDIT_OBJ_ROLE:	3378	case AUDIT_OBJ_ROLE:
3379	rc = -EINVAL;	3379	rc = -EINVAL;
3380	roledatum = hashtab_search(&policydb->p_roles.table, rulestr);	3380	roledatum = symtab_search(&policydb->p_roles, rulestr);
3381	if (!roledatum)	3381	if (!roledatum)
3382	goto out;	3382	goto out;
3383	tmprule->au_ctxt.role = roledatum->value;	3383	tmprule->au_ctxt.role = roledatum->value;
@@ -3385,7 +3385,7 @@ int selinux_audit_rule_init(u32 field, u32 op, char rulestr, void *vrule) · 1 unmodified line
3385	case AUDIT_SUBJ_TYPE:	3385	case AUDIT_SUBJ_TYPE:
3386	case AUDIT_OBJ_TYPE:	3386	case AUDIT_OBJ_TYPE:
3387	rc = -EINVAL;	3387	rc = -EINVAL;
3388	typedatum = hashtab_search(&policydb->p_types.table, rulestr);	3388	typedatum = symtab_search(&policydb->p_types, rulestr);
3389	if (!typedatum)	3389	if (!typedatum)
3390	goto out;	3390	goto out;
3391	tmprule->au_ctxt.type = typedatum->value;	3391	tmprule->au_ctxt.type = typedatum->value;

security/selinux/ss/symtab.c+17−4

 #include <linux/errno.h>
 #include "symtab.h"
-static unsigned int symhash(struct hashtab *h, const void *key)
+static unsigned int symhash(const void *key)
 {
 	const char *p, *keyp;
 	unsigned int size;
 	size = strlen(keyp);
 	for (p = keyp; (p - keyp) < size; p++)
 		val = (val << 4 | (val >> (8*sizeof(unsigned int)-4))) ^ (*p);
-	return val & (h->size - 1);
+	return val;
 }
-static int symcmp(struct hashtab *h, const void *key1, const void *key2)
+static int symcmp(const void *key1, const void *key2)
 {
 	const char *keyp1, *keyp2;
 	return strcmp(keyp1, keyp2);
 }
+static const struct hashtab_key_params symtab_key_params = {
+	.hash = symhash,
+	.cmp = symcmp,
+};
 int symtab_init(struct symtab *s, unsigned int size)
 {
 	s->nprim = 0;
-	return hashtab_init(&s->table, symhash, symcmp, size);
+	return hashtab_init(&s->table, size);
 }
+int symtab_insert(struct symtab *s, char *name, void *datum)
+{
+	return hashtab_insert(&s->table, name, datum, symtab_key_params);
+}
+void *symtab_search(struct symtab *s, const char *name)
+{
+	return hashtab_search(&s->table, name, symtab_key_params);
+}

security/selinux/ss/symtab.h+3−0

@@ -19,6 +19,9 @@ struct symtab { · 18 unmodified lines
19		19
20	int symtab_init(struct symtab *s, unsigned int size);	20	int symtab_init(struct symtab *s, unsigned int size);
21		21
		22	int symtab_insert(struct symtab s, char name, void *datum);
		23	void symtab_search(struct symtab s, const char *name);
		24
22	#endif /* _SS_SYMTAB_H_ */	25	#endif /* _SS_SYMTAB_H_ */
23		26
24		27